Dynamic deployment of access controls anchored on request actions

ABSTRACT

Techniques and structures to provide dynamic deployment of access controls in an on-demand environment. A host electronic device may comprise one or more processors coupled with the at least one physical memory device, the one or more processors configurable to receive, via a user interface, request to access one or more resources managed by the electronic device in the multi-user, on demand computing environment, the request comprising one or more request elements, determine whether a virtual access rule logic comprises one or more virtual access check rules which are anchored to the one or more request elements, and in response to a determination that the virtual access rule logic comprises one or more virtual access check rules which are anchored to the one or more request elements, apply the one or more virtual access check rules to the request. Additional subject matter may be described and claimed.

CLAIM OF PRIORITY

The subject application is a continuation of U.S. patent applicationSer. No. 16/175,308, entitled “DYNAMIC DEPLOYMENT OF ACCESS CONTROLSANCHORED ON REQUEST ACTIONS,” filed Oct. 30, 2018, the contents of whichare incorporated herein by reference in their entirety.

TECHNICAL FIELD

One or more implementations relate generally to access control in anon-demand services environment.

BACKGROUND

The subject matter discussed in the background section should not beassumed to be prior art merely as a result of its mention in thebackground section. Similarly, a problem mentioned in the backgroundsection or associated with the subject matter of the background sectionshould not be assumed to have been previously recognized in the priorart. The subject matter in the background section merely representsdifferent approaches.

A host organization in an on-demand services environment receivesrequests from users for services provided by the host organization.Adroit management of service requests may find utility.

BRIEF DESCRIPTION OF THE DRAWINGS

In the following drawings like reference numbers are used to refer tolike elements. Although the following figures depict various examples,one or more implementations are not limited to the examples depicted inthe figures.

FIG. 1 illustrates a system having a computing device employing anaccess management mechanism according to one embodiment.

FIG. 2 illustrates an access management mechanism according to oneembodiment.

FIGS. 3-4 illustrate operations in a method for access managementaccording to one embodiment.

FIG. 5 illustrates a computer system according to one embodiment.

FIG. 6 illustrates an environment wherein an on-demand database servicemight be used according to one embodiment.

FIG. 7 illustrates elements of environment of FIG. 6 and variouspossible interconnections between these elements according to oneembodiment.

DETAILED DESCRIPTION

In the following description, numerous specific details are set forth.However, embodiments of the invention may be practiced without thesespecific details. In other instances, well-known structures andtechniques have not been shown in detail in order not to obscure theunderstanding of this description.

It is contemplated that embodiments and their implementations are notmerely limited to multi-tenant database system (“MTDBS”) and can be usedin other environment, such as a client-server system, a mobile device, apersonal computer (“PC”), a web services environment, etc. However, forthe sake of brevity and clarity, throughout this document, embodimentsare described with respect to a multi-tenant database system, such asSalesforce.com®, which is to be regarded as an example of an on-demandservices environment. Other on-demand services environments includeSalesforce® Exact Target Marketing Cloud™.

As used herein, a term multi-tenant database system refers to thosesystems in which various elements of hardware and software of thedatabase system may be shared by one or more customers. For example, agiven application server may simultaneously process requests for a greatnumber of customers, and a given database table may store rows for apotentially much greater number of customers. As used herein, the termquery plan refers to a set of steps used to access information in adatabase system.

Embodiments are described with reference to an embodiment in whichtechniques for facilitating dynamic deployment of access controlsanchored on request actions in an on-demand services environment areimplemented in a system having an application server providing a frontend for an on-demand database service capable of supporting multipletenants, embodiments are not limited to multi-tenant databases nordeployment on application servers. Embodiments may be practiced usingother database architectures, i.e., ORACLE®, DB2® by IBM and the likewithout departing from the scope of the embodiments claimed.

FIG. 1 illustrates a system 100 having a computing device 120 employingan access management mechanism 110 according to one embodiment. In oneembodiment, computing device 120 includes a host server computer servinga host machine for employing access management mechanism 110 forfacilitating dynamic deployment of access controls anchored on requestactions of resources in a multi-tiered, multi-tenant, on-demand servicesenvironment.

It is to be noted that terms like “queue message”, “job”, “query”,“request” or simply “message” may be referenced interchangeably andsimilarly, terms like “job types”, “message types”, “query type”, and“request type” may be referenced interchangeably throughout thisdocument. It is to be further noted that messages may be associated withone or more message types, which may relate to or be associated with oneor more customer organizations, such as customer organizations121A-121N, where, as aforementioned, throughout this document, “customerorganizations” may be referred to as “tenants”, “customers”, or simply“organizations”. An organization, for example, may include or refer to(without limitation) a business (e.g., small business, big business,etc.), a company, a corporation, a non-profit entity, an institution(e.g., educational institution), an agency (e.g., government agency),etc.), etc., serving as a customer or client of host organization 101(also referred to as “service provider” or simply “host”), such asSalesforce.com®, serving as a host of access management mechanism 110.

Similarly, the term “user” may refer to a system user, such as (withoutlimitation) a software/application developer, a system administrator, adatabase administrator, an information technology professional, aprogram manager, product manager, etc. The term “user” may further referto an end-user, such as (without limitation) one or more of customerorganizations 121A-N and/or their representatives (e.g., individuals orgroups working on behalf of one or more of customer organizations121A-N), such as a salesperson, a sales manager, a product manager, anaccountant, a director, an owner, a president, a system administrator, acomputer programmer, an information technology (“IT”) representative,etc.

Computing device 120 may include (without limitation) server computers(e.g., cloud server computers, etc.), desktop computers, cluster-basedcomputers, set-top boxes (e.g., Internet-based cable television set-topboxes, etc.), etc. Computing device 120 includes an operating system(“OS”) 106 serving as an interface between one or more hardware/physicalresources of computing device 120 and one or more client devices130A-130N, etc. Computing device 120 further includes processor(s) 102,memory 104, input/output (“I/O”) sources 108, such as touchscreens,touch panels, touch pads, virtual or regular keyboards, virtual orregular mice, etc.

In one embodiment, host organization 101 may further employ a productionenvironment that is communicably interfaced with client devices 130A-Nthrough host organization 101. Client devices 130A-N may include(without limitation) customer organization-based server computers,desktop computers, laptop computers, mobile computing devices, such assmartphones, tablet computers, personal digital assistants, e-readers,media Internet devices, smart televisions, television platforms,wearable devices (e.g., glasses, watches, bracelets, smartcards,jewelry, clothing items, etc.), media players, global positioningsystem-based navigation systems, cable setup boxes, etc.

In one embodiment, the illustrated multi-tenant database system 150includes database(s) 140 to store (without limitation) information,relational tables, datasets, and underlying database records havingtenant and user data therein on behalf of customer organizations 121A-N(e.g., tenants of multi-tenant database system 150 or their affiliatedusers). In alternative embodiments, a client-server computingarchitecture may be utilized in place of multi-tenant database system150, or alternatively, a computing grid, or a pool of work servers, orsome combination of hosted computing architectures may be utilized tocarry out the computational workload and processing that is expected ofhost organization 101.

The illustrated multi-tenant database system 150 is shown to include oneor more of underlying hardware, software, and logic elements 145 thatimplement, for example, database functionality and a code executionenvironment within host organization 101. In accordance with oneembodiment, multi-tenant database system 150 further implementsdatabases 140 to service database queries and other data interactionswith the databases 140. In one embodiment, hardware, software, and logicelements 145 of multi-tenant database system 150 and its other elements,such as a distributed file store, a query interface, etc., may beseparate and distinct from customer organizations (121A-121N) whichutilize the services provided by host organization 101 by communicablyinterfacing with host organization 101 via network(s) 135 (e.g., cloudnetwork, the Internet, etc.). In such a way, host organization 101 mayimplement on-demand services, on-demand database services, cloudcomputing services, etc., to subscribing customer organizations121A-121N.

In some embodiments, host organization 101 receives input and otherrequests from a plurality of customer organizations 121A-N over one ormore networks 135; for example, incoming search queries, databasequeries, application programming interface (“API”) requests,interactions with displayed graphical user interfaces and displays atclient devices 130A-N, or other inputs may be received from customerorganizations 121A-N to be processed against multi-tenant databasesystem 150 as queries via a query interface and stored at a distributedfile store, pursuant to which results are then returned to an originatoror requestor, such as a user of client devices 130A-N at any of customerorganizations 121A-N.

As aforementioned, in one embodiment, each customer organization 121A-Nmay include an entity selected from a group consisting of a separate anddistinct remote organization, an organizational group within hostorganization 101, a business partner of host organization 101, acustomer organization 121A-N that subscribes to cloud computing servicesprovided by host organization 101, etc.

In one embodiment, requests are received at, or submitted to, a webserver within host organization 101. Host organization 101 may receive avariety of requests for processing by host organization 101 and itsmulti-tenant database system 150. For example, incoming requestsreceived at the web server may specify which services from hostorganization 101 are to be provided, such as query requests, searchrequest, status requests, database transactions, graphical userinterface requests and interactions, processing requests to retrieve,update, or store data on behalf of one of customer organizations 121A-N,code execution requests, and so forth. Further, the web-server at hostorganization 101 may be responsible for receiving requests from variouscustomer organizations 121A-N via network(s) 135 on behalf of the queryinterface and for providing a web-based interface or other graphicaldisplays to one or more end-user client devices 130A-N or machinesoriginating such data requests.

Further, host organization 101 may implement a request interface via theweb server or as a stand-alone interface to receive requests packets orother requests from the client devices 130A-N. The request interface mayfurther support the return of response packets or other replies andresponses in an outgoing direction from host organization 101 to one ormore client devices 130A-N.

It is to be noted that any references to software codes, data and/ormetadata (e.g., Customer Relationship Model (“CRM”) data and/ormetadata, etc.), tables (e.g., custom object table, unified indextables, description tables, etc.), computing devices (e.g., servercomputers, desktop computers, mobile computers, such as tabletcomputers, smartphones, etc.), software development languages,applications, and/or development tools or kits (e.g., Force.com®,Force.com Apex™ code, JavaScript™, JQuery™, Developerforce™,Visualforce™, Service Cloud Console Integration Toolkit™ (“IntegrationToolkit” or “Toolkit”), Platform on a Service™ (“PaaS”), Chatter®Groups, Sprint Planner®, MS Project®, etc.), domains (e.g., Google®,Facebook®, LinkedIn®, Skype®, etc.), etc., discussed in this documentare merely used as examples for brevity, clarity, and ease ofunderstanding and that embodiments are not limited to any particularnumber or type of data, metadata, tables, computing devices, techniques,programming languages, software applications, software developmenttools/kits, etc.

It is to be noted that terms like “node”, “computing node”, “server”,“server device”, “cloud computer”, “cloud server”, “cloud servercomputer”, “machine”, “host machine”, “device”, “computing device”,“computer”, “computing system”, “multi-tenant on-demand data system”,and the like, may be used interchangeably throughout this document. Itis to be further noted that terms like “code”, “software code”,“application”, “software application”, “program”, “software program”,“package”, “software code”, “code”, and “software package” may be usedinterchangeably throughout this document. Moreover, terms like “job”,“input”, “request”, and “message” may be used interchangeably throughoutthis document.

FIG. 2 illustrates various aspects of the access management mechanism110 described with reference to FIG. 1, according to one embodiment. Inone embodiment, a computing device such as a server computer 120 mayinclude an administrative engine 201 comprising any number and type ofcomponents, such as request/query logic 201, authentication logic 205;communication/compatibility logic 207, and interface logic 209.Similarly, computing device 120 may further include access managementengine 211 including (without limitation): request management logic 213,anchorless rule logic 215 and virtual access control (VAC) rule logic217.

In one embodiment, computing device 120 may serve as a service providercore (e.g., Salesforce.com® core) for hosting and maintaining accessmanagement mechanism 110 and be in communication with one or moredatabase(s) 140, one or more client computers 130A-N, over one or morenetwork(s) 135, and any number and type of dedicated nodes.

Throughout this document, terms like “framework”, “mechanism”, “engine”,“logic”, “component”, “module”, “tool”, and “builder” may be referencedinterchangeably and include, by way of example, software, hardware,and/or any combination of software and hardware, such as firmware.Further, any use of a particular brand, word, or term, such as“package”, “packaging”, “additive package”, “wrapping”, “bundling”,“bonding”, “morphing”, “mapping”, “metadata”, “customization”,“testing”, “updating”, “upgrading”, etc., should not be read to limitembodiments to software or devices that carry that label in products orin literature external to this document.

As aforementioned, with respect to FIG. 1, any number and type ofrequests and/or queries may be received at or submitted to request/querylogic 203 for processing. For example, incoming requests may specifywhich services from computing device 120 are to be provided, such asquery requests, search request, status requests, database transactions,graphical user interface requests and interactions, processing requeststo retrieve, update, or store data, etc., on behalf of one or moreclient devices 130A-N, code execution requests, and so forth.

In one embodiment, computing device 120 may implement request/querylogic 203 to serve as a request/query interface via a web server or as astand-alone interface to receive requests packets or other requests fromthe client devices 130A-N. The request interface may further support thereturn of response packets or other replies and responses in an outgoingdirection from computing device 120 to one or more client devices130A-N.

Similarly, request/query logic 203 may serve as a query interface toprovide additional functionalities to pass queries from, for example, aweb service into the multi-tenant database system for execution againstdatabase(s) 140 and retrieval of customer data and stored recordswithout the involvement of the multi-tenant database system or forprocessing search queries via the multi-tenant database system, as wellas for the retrieval and processing of data maintained by otheravailable data stores of the host organization's production environment.Further, authentication logic 205 may operate on behalf of the hostorganization, via computing device 120, to verify, authenticate, andauthorize, user credentials associated with users attempting to gainaccess to the host organization via one or more client devices 130A-N.

In one embodiment, computing device 120 may include a server computerwhich may be further in communication with one or more databases orstorage repositories, such as database(s) 140, which may be locatedlocally or remotely over one or more networks, such as network(s) 135(e.g., cloud network, Internet, proximity network, intranet, Internet ofThings (“IoT”), Cloud of Things (“CoT”), etc.). Computing device 120 isfurther shown to be in communication with any number and type of othercomputing devices, such as client computing devices 130A-N, over one ormore networks, such as network(s) 135.

In one embodiment, as illustrated, access management mechanism 110includes access management engine 211 to allow for a novel technique formanaging access to resources in any number and type of environments. Inthe embodiment depicted in FIG. 2 a client computing device 130A-130Nmay include a resource request logic 220, a resource size analysis logic222 and a communication logic 222.

For example, in one embodiment one or more resources may be requested bya user associated with a tenant using computing device 130A, which maythen be received by server computing device 120 over network(s) 135 asfacilitated by communication/compatibility logic 207. For example, theresource request having the proposal may be initiated in the clientcomputing device 130A through resource request logic 220 and receivedthrough request/query logic 203 and verified or authenticated byauthentication logic 205 and then forwarded on to access managementengine 211 for subsequent processing.

Communication/compatibility logic 207 may facilitate the ability todynamically communicate and stay configured with any number and type ofsoftware/application developing tools, models, data processing servers,database platforms and architectures, programming languages and theircorresponding platforms, etc., while ensuring compatibility withchanging technologies, parameters, protocols, standards, etc.

In one embodiment, interface logic 209 may be used to offer access toresources to users, such as software developers, end-users, etc., thoughone or more interfaces at one or more computing devices 120, 130A-Nusing one or more of their display devices/screens as furtherfacilitated by communication/compatibility logic 207. It is contemplatedthat the one or more interfaces are not limited to any particular numberor type of interfaces such that an interface may include (withoutlimitations) any one or more of a user interface (e.g., Web browser,Graphical User Interface (GUI), software application-based interface,etc.), an application programming interface (API), a RepresentationalState Transfer (REST) or RESTful API, and/or the like.

It is contemplated that a tenant may include an organization of any sizeor type, such as a business, a company, a corporation, a governmentagency, a philanthropic or non-profit entity, an educationalinstitution, etc., having single or multiple departments (e.g.,accounting, marketing, legal, etc.), single or multiple layers ofauthority (e.g., C-level positions, directors, managers, receptionists,etc.), single or multiple types of businesses or sub-organizations(e.g., sodas, snacks, restaurants, sponsorships, charitable foundation,services, skills, time etc.) and/or the like.

In one embodiment, access management engine 211 comprises requestmanagement logic 213, anchorless rule logic 215, and virtual accesscheck (VAC) logic 217. In some examples request management logic 213implements operations to manage access checks for requests received bythe computing device 120. Anchorless rule logic 215 comprises one ormore rules that impose access controls upon services offered bycomputing device 120. VAC rule logic comprises one or more rules whichfacilitate novel techniques for implementing dynamic deployment ofaccess controls anchored on request actions so that server computingdevice 120 can selectively decline to implement request(s) from a clientcomputing device 130A-130N based at least in part on one or more VirtualAccess Check (VAC) rules that are anchored to specific request actions.

Having described various aspects of structure and components toimplement dynamic deployment of access control anchored on requestactions, operations to implement dynamic deployment of access controlanchored on request actions will be described with reference to FIGS.3-4. In some examples the operations depicted in FIGS. 3-4 may beperformed by processing logic that may comprise hardware (e.g.,circuitry, dedicated logic, programmable logic, etc.), software (such asinstructions run on a processing device), or a combination thereof. Inone embodiment, the operations depicted in FIGS. 3-4 may be performed orfacilitated by one or more components of access management engine 211 ofFIGS. 1-2 and/or the various logic modules depicted in client computingdevice 130A-N depicted in FIGS. 1-2. The operations depicted in FIG. 3are illustrated in linear sequences for brevity and clarity inpresentation; however, it is contemplated that any number of them can beperformed in parallel, asynchronously, or in different orders. Further,for brevity, clarity, and ease of understanding, many of the componentsand processes described with respect to FIGS. 1-2 may not be repeated ordiscussed hereafter.

Referring to FIG. 3, at operation 310 a request is received at thecomputing device 120 for access to one or more resources managed by thecomputing device 120. In some examples the request may comprise one ormore hypertext transfer protocol (http) requests which may includeinformation such as uniform resource identifiers (URIs), headers, verbs(i.e., POST, GET, . . . etc). In some examples entity operations thatoccur or user permissions that get checked during the request arespecified by the endpoint that is being loaded by the request, althoughthese resources need not be directly specified in the request itself. Insome examples a request can cause an account to be updated, a user beingcreated, may result in a “ManageOtherUsers” permission being checked,etc.

At operation 315 a determination is made regarding whether the requestmatches one or more anchorless rules to be applied to requests. In someexamples the received request may be compared to one or more rules inthe anchorless rule logic 215. Anchorless rules are referred to asanchorless because they do not depend on resources that may be engagedduring the lifetime of the request. In some examples, anchorless rulesmay be dependent on things available directly in the http request. Forexample, an anchorless rule may seek to block all POST requests to acertain URI pattern.

If, at operation 315, the request matches one or more anchorless rulesto be applied to requests then control passes to operation 320 and theaccess management engine 211 applies anchorless rule enforcement logicto the request.

If, at operation 325 the anchorless rule enforcement logic applied inoperation 325 includes one or more rules that are blocking rules for therequest then control passes to operation 350 and the access managementengine 211 blocks the request to the computing device 120. By contrast,if at operation 325 the anchorless rule enforcement logic applied inoperation 325 does not include one or more rules that are blocking rulesfor the request then control passes to operation 330 and the accessmanagement engine 211 applies anchored rule enforcement logic to therequest received in operation 310.

In some examples the VAC rule logic 217 may comprise one or more VACrules, which may be implemented as declarative control objects which canbe deployed dynamically to enforce additional access checks againstrequests. The declaration of a VAC rule specifies under whatcircumstances to enforce the rule and block a request to computingdevice 120. In some examples VAC rules may be used to narrowly definewhich requests to block by “anchoring” their enforcement on certainoperations that may occur during a request's lifecycle. If a VAC rulespecifies an action as an “anchor,” then the VAC rule will be evaluatedif and when that action occurs during the request's lifecycle and notduring the application of anchorless rules.

In one example a VAC rule may be anchored to a user permission check.Thus, at operation 335 the request causes one or more aspects of a userpermission to be evaluated. For example, a given user interface (UI)page may require a check to determine whether a user has a particulartype of permission (e.g., a ManageCustomerInfo permission), and may alsocheck to determine whether the whether the user's organization has arelated permission (e.g, a GovernmentClearance permission). Thus, in oneexample a VAC rule used to fix this malformed access may could check theGovernmentClearance permission and be anchored on the ManageCustomerInfopermission. If, at operation 335 one or more of the user permissiontests fails then control passes to operation 350 and the accessmanagement engine 211 blocks the request to the computing device 120. Bycontrast, if at operation 335 the user passes the one or more rulesanchored to a user permission then control passes to operation 340.

At operation 340 the request causes one or more aspects of an entityoperation to be evaluated. In some examples a VAC rule may be anchoredon an entity operation and will only be evaluated if the request causesan entity to be created/updated/deleted. For example, users should onlybe able to make changes to accounts if they have a specific permission(e.g., a ManageAccounts permission), but this permission is not beingproperly checked at all endpoints. A VAC rule addressing this error maybe anchored on an “update Account” operation associated with a request.Evaluation of the rule may take place before any time that a requestwould cause an Account object to be updated.

If, at operation 340, one or more entity operation permission tests failthen control passes to operation 350 and the access management engine211 blocks the request to the computing device 120. By contrast, if atoperation 340 the entity passes the one or more rules anchored to anentity operation then control passes to operation 345.

If, at operation 345, there are additional rules anchored to otheroperations to be applied to the request then control passes to operation355 and the additional rules are applied in an analogous fashion to themanner in which the user permission rule(s) were applied in operation335 and the entity permission rule(s) were applied in operation 340. Bycontrast, if at operation 345 there are no further rules anchored toother operations to be applied to the request then control passes tooperation 360 and the request is implemented.

Thus, the structure depicted in FIGS. 1-2 and the operations depicted inFIG. 3 enable the implementation of dynamic deployment of access controlanchored on request actions. In some examples the VAC rules may beimplemented in the form of JavaScript Object Notation (JSON) rule toexpress certain conditions under which it may be useful to block useractions. VAC rules may be used to enforce access controls that may beimproperly implemented. In some examples VAC rules can be dynamicallydeployed across all live instances of a multi-user platform from aninternal console. Anchoring an access check to a certain action (e.g.,permission checks and/or entity actions) allows a user to narrowlydefine when to enforce the access check.

FIG. 4 is an example of a VAC rule in JSON form. In this example,under-privileged users are able to edit other users' accounts as theresult of a bug. The rule depicted in FIG. 4 patches that vulnerability.The URI, anchor, and added access check fields are used to determinewhether a rule matches the current request. If the request matches theURI pattern specified, touches whatever resource is specified in anchor,and lacks the added access check specified, then the request matches therule. In this event, the request is subject to rule enforcement logic,which is defined by the execution criteria and rule action fields. Theexecution criteria field must evaluate to true for enforcement to takeplace—it is a way of checking specific criteria of the request beingsubjected to rule enforcement. Finally, the rule action field specifieswhat action to take should the rule be enforced—in many cases this meansto block the request.

FIG. 5 illustrates a diagrammatic representation of a machine 500 in theexemplary form of a computer system, in accordance with one embodiment,within which a set of instructions, for causing the machine 500 toperform any one or more of the methodologies discussed herein, may beexecuted. Machine 500 is the same as or similar to computing devices120, 130A-N of FIG. 1. In alternative embodiments, the machine may beconnected (e.g., networked) to other machines in a network (such as hostmachine 120 connected with client machines 130A-N over network(s) 135 ofFIG. 1), such as a cloud-based network, Internet of Things (IoT) orCloud of Things (CoT), a Local Area Network (LAN), a Wide Area Network(WAN), a Metropolitan Area Network (MAN), a Personal Area Network (PAN),an intranet, an extranet, or the Internet. The machine may operate inthe capacity of a server or a client machine in a client-server networkenvironment, or as a peer machine in a peer-to-peer (or distributed)network environment or as a server or series of servers within anon-demand service environment, including an on-demand environmentproviding multi-tenant database storage services. Certain embodiments ofthe machine may be in the form of a personal computer (PC), a tablet PC,a set-top box (STB), a Personal Digital Assistant (PDA), a cellulartelephone, a web appliance, a server, a network router, switch orbridge, computing system, or any machine capable of executing a set ofinstructions (sequential or otherwise) that specify actions to be takenby that machine. Further, while only a single machine is illustrated,the term “machine” shall also be taken to include any collection ofmachines (e.g., computers) that individually or jointly execute a set(or multiple sets) of instructions to perform any one or more of themethodologies discussed herein.

The exemplary computer system 500 includes a processor 502, a mainmemory 504 (e.g., read-only memory (ROM), flash memory, dynamic randomaccess memory (DRAM) such as synchronous DRAM (SDRAM) or Rambus DRAM(RDRAM), etc., static memory such as flash memory, static random accessmemory (SRAM), volatile but high-data rate RAM, etc.), and a secondarymemory 518 (e.g., a persistent storage device including hard disk drivesand persistent multi-tenant data base implementations), whichcommunicate with each other via a bus 530. Main memory 504 includesemitted execution data 524 (e.g., data emitted by a logging framework)and one or more trace preferences 523 which operate in conjunction withprocessing logic 526 and processor 502 to perform the methodologiesdiscussed herein.

Processor 502 represents one or more general-purpose processing devicessuch as a microprocessor, central processing unit, or the like. Moreparticularly, the processor 502 may be a complex instruction setcomputing (CISC) microprocessor, reduced instruction set computing(RISC) microprocessor, very long instruction word (VLIW) microprocessor,processor implementing other instruction sets, or processorsimplementing a combination of instruction sets. Processor 502 may alsobe one or more special-purpose processing devices such as an applicationspecific integrated circuit (ASIC), a field programmable gate array(FPGA), a digital signal processor (DSP), network processor, or thelike. Processor 502 is configured to execute the processing logic 526for performing the operations and functionality of access managementmechanism 110 as described with reference to FIG. 1 and other Figuresdiscussed herein.

The computer system 500 may further include a network interface card508. The computer system 500 also may include a user interface 510 (suchas a video display unit, a liquid crystal display (LCD), or a cathoderay tube (CRT)), an alphanumeric input device 512 (e.g., a keyboard), acursor control device 514 (e.g., a mouse), and a signal generationdevice 516 (e.g., an integrated speaker). The computer system 500 mayfurther include peripheral device 536 (e.g., wireless or wiredcommunication devices, memory devices, storage devices, audio processingdevices, video processing devices, etc. The computer system 500 mayfurther include a Hardware based API logging framework 534 capable ofexecuting incoming requests for services and emitting execution dataresponsive to the fulfillment of such incoming requests.

The secondary memory 518 may include a machine-readable storage medium(or more specifically a machine-accessible storage medium) 531 on whichis stored one or more sets of instructions (e.g., software 522)embodying any one or more of the methodologies or functions of accessmanagement mechanism 110 as described with reference to FIG. 1,respectively, and other figures discussed herein. The software 522 mayalso reside, completely or at least partially, within the main memory504 and/or within the processor 502 during execution thereof by thecomputer system 500, the main memory 504 and the processor 502 alsoconstituting machine-readable storage media. The software 522 mayfurther be transmitted or received over a network 520 via the networkinterface card 508. The machine-readable storage medium 531 may includetransitory or non-transitory machine-readable storage media.

Portions of various embodiments may be provided as a computer programproduct, which may include a computer-readable medium having storedthereon computer program instructions, which may be used to program acomputer (or other electronic devices) to perform a process according tothe embodiments. The machine-readable medium may include, but is notlimited to, floppy diskettes, optical disks, compact disk read-onlymemory (CD-ROM), and magneto-optical disks, ROM, RAM, erasableprogrammable read-only memory (EPROM), electrically EPROM (EEPROM),magnet or optical cards, flash memory, or other type ofmedia/machine-readable medium suitable for storing electronicinstructions.

The techniques shown in the figures can be implemented using code anddata stored and executed on one or more electronic devices (e.g., an endstation, a network element). Such electronic devices store andcommunicate (internally and/or with other electronic devices over anetwork) code and data using computer-readable media, such asnon-transitory computer-readable storage media (e.g., magnetic disks;optical disks; random access memory; read only memory; flash memorydevices; phase-change memory) and transitory computer-readabletransmission media (e.g., electrical, optical, acoustical or other formof propagated signals—such as carrier waves, infrared signals, digitalsignals). In addition, such electronic devices typically include a setof one or more processors coupled to one or more other components, suchas one or more storage devices (non-transitory machine-readable storagemedia), user input/output devices (e.g., a keyboard, a touchscreen,and/or a display), and network connections. The coupling of the set ofprocessors and other components is typically through one or more bussesand bridges (also termed as bus controllers). Thus, the storage deviceof a given electronic device typically stores code and/or data forexecution on the set of one or more processors of that electronicdevice. Of course, one or more parts of an embodiment may be implementedusing different combinations of software, firmware, and/or hardware.

FIG. 6 illustrates a block diagram of an environment 610 wherein anon-demand database service might be used. Environment 610 may includeuser systems 612, network 614, system 616, processor system 617,application platform 618, network interface 620, tenant data storage622, system data storage 624, program code 626, and process space 628.In other embodiments, environment 610 may not have all of the componentslisted and/or may have other elements instead of, or in addition to,those listed above.

Environment 610 is an environment in which an on-demand database serviceexists. User system 612 may be any machine or system that is used by auser to access a database user system. For example, any of user systems612 can be a handheld computing device, a mobile phone, a laptopcomputer, a workstation, and/or a network of computing devices. Asillustrated in herein FIG. 6 (and in more detail in FIG. 7) user systems612 might interact via a network 614 with an on-demand database service,which is system 616.

An on-demand database service, such as system 616, is a database systemthat is made available to outside users that do not need to necessarilybe concerned with building and/or maintaining the database system, butinstead may be available for their use when the users need the databasesystem (e.g., on the demand of the users). Some on-demand databaseservices may store information from one or more tenants stored intotables of a common database image to form a multi-tenant database system(MTS). Accordingly, “on-demand database service 616” and “system 616”will be used interchangeably herein. A database image may include one ormore database objects. A relational database management system (RDMS) orthe equivalent may execute storage and retrieval of information againstthe database object(s). Application platform 618 may be a framework thatallows the applications of system 616 to run, such as the hardwareand/or software, e.g., the operating system. In an embodiment, on-demanddatabase service 616 may include an application platform 618 thatenables creation, managing and executing one or more applicationsdeveloped by the provider of the on-demand database service, usersaccessing the on-demand database service via user systems 612, or thirdparty application developers accessing the on-demand database servicevia user systems 612.

The users of user systems 612 may differ in their respective capacities,and the capacity of a particular user system 612 might be entirelydetermined by permissions (permission levels) for the current user. Forexample, where a salesperson is using a particular user system 612 tointeract with system 616, that user system has the capacities allottedto that salesperson. However, while an administrator is using that usersystem to interact with system 616, that user system has the capacitiesallotted to that administrator. In systems with a hierarchical rolemodel, users at one permission level may have access to applications,data, and database information accessible by a lower permission leveluser, but may not have access to certain applications, databaseinformation, and data accessible by a user at a higher permission level.Thus, different users will have different capabilities with regard toaccessing and modifying application and database information, dependingon a user's security or permission level.

Network 614 is any network or combination of networks of devices thatcommunicate with one another. For example, network 614 can be any one orany combination of a LAN (local area network), WAN (wide area network),telephone network, wireless network, point-to-point network, starnetwork, token ring network, hub network, or other appropriateconfiguration. As the most common type of computer network in currentuse is a TCP/IP (Transfer Control Protocol and Internet Protocol)network, such as the global internetwork of networks often referred toas the “Internet” with a capital “I,” that network will be used in manyof the examples herein. However, it should be understood that thenetworks that one or more implementations might use are not so limited,although TCP/IP is a frequently implemented protocol.

User systems 612 might communicate with system 616 using TCP/IP and, ata higher network level, use other common Internet protocols tocommunicate, such as HTTP, FTP, AFS, WAP, etc. In an example where HTTPis used, user system 612 might include an HTTP client commonly referredto as a “browser” for sending and receiving HTTP messages to and from anHTTP server at system 616. Such an HTTP server might be implemented asthe sole network interface between system 616 and network 614, but othertechniques might be used as well or instead. In some implementations,the interface between system 616 and network 614 includes load-sharingfunctionality, such as round-robin HTTP request distributors to balanceloads and distribute incoming HTTP requests evenly over a plurality ofservers. At least as for the users that are accessing that server, eachof the plurality of servers has access to the MTS' data; however, otheralternative configurations may be used instead.

In one embodiment, system 616, shown in FIG. 6, implements a web-basedcustomer relationship management (CRM) system. For example, in oneembodiment, system 616 includes application servers configured toimplement and execute CRM software applications as well as providerelated data, code, forms, webpages and other information to and fromuser systems 612 and to store to, and retrieve from, a database systemrelated data, objects, and Webpage content. With a multi-tenant system,data for multiple tenants may be stored in the same physical databaseobject, however, tenant data typically is arranged so that data of onetenant is kept logically separate from that of other tenants so that onetenant does not have access to another tenant's data, unless such datais expressly shared. In certain embodiments, system 616 implementsapplications other than, or in addition to, a CRM application. Forexample, system 616 may provide tenant access to multiple hosted(standard and custom) applications, including a CRM application. User(or third party developer) applications, which may or may not includeCRM, may be supported by the application platform 618, which managescreation, storage of the applications into one or more database objectsand executing of the applications in a virtual machine in the processspace of the system 616.

One arrangement for elements of system 616 is shown in FIG. 6, includinga network interface 620, application platform 618, tenant data storage622 for tenant data 623, system data storage 624 for system data 625accessible to system 616 and possibly multiple tenants, program code 626for implementing various functions of system 616, and a process space628 for executing MTS system processes and tenant-specific processes,such as running applications as part of an application hosting service.Additional processes that may execute on system 616 includedatabase-indexing processes.

Several elements in the system shown in FIG. 6 include conventional,well-known elements that are explained only briefly here. For example,each user system 612 could include a desktop personal computer,workstation, laptop, PDA, cell phone, or any wireless access protocol(WAP) enabled device or any other computing device capable ofinterfacing directly or indirectly to the Internet or other networkconnection. User system 612 typically runs an HTTP client, e.g., abrowsing program, such as Microsoft's Internet Explorer browser,Netscape's Navigator browser, Opera's browser, or a WAP-enabled browserin the case of a cell phone, PDA or other wireless device, or the like,allowing a user (e.g., subscriber of the multi-tenant database system)of user system 612 to access, process and view information, pages andapplications available to it from system 616 over network 614. Usersystem 612 further includes Mobile OS (e.g., iOS® by Apple®, Android®,WebOS® by Palm®, etc.). Each user system 612 also typically includes oneor more user interface devices, such as a keyboard, a mouse, trackball,touch pad, touch screen, pen or the like, for interacting with agraphical user interface (GUI) provided by the browser on a display(e.g., a monitor screen, LCD display, etc.) in conjunction with pages,forms, applications and other information provided by system 616 orother systems or servers. For example, the user interface device can beused to access data and applications hosted by system 616, and toperform searches on stored data, and otherwise allow a user to interactwith various GUI pages that may be presented to a user. As discussedabove, embodiments are suitable for use with the Internet, which refersto a specific global internetwork of networks. However, it should beunderstood that other networks can be used instead of the Internet, suchas an intranet, an extranet, a virtual private network (VPN), anon-TCP/IP based network, any LAN or WAN or the like.

According to one embodiment, each user system 612 and all of itscomponents are operator configurable using applications, such as abrowser, including computer code run using a central processing unitsuch as an Intel Core® processor or the like. Similarly, system 616 (andadditional instances of an MTS, where more than one is present) and allof their components might be operator configurable using application(s)including computer code to run using a central processing unit such asprocessor system 617, which may include an Intel Pentium® processor orthe like, and/or multiple processor units. A computer program productembodiment includes a machine-readable storage medium (media) havinginstructions stored thereon/in which can be used to program a computerto perform any of the processes of the embodiments described herein.Computer code for operating and configuring system 616 tointercommunicate and to process webpages, applications and other dataand media content as described herein are preferably downloaded andstored on a hard disk, but the entire program code, or portions thereof,may also be stored in any other volatile or non-volatile memory mediumor device as is well known, such as a ROM or RAM, or provided on anymedia capable of storing program code, such as any type of rotatingmedia including floppy disks, optical discs, digital versatile disk(DVD), compact disk (CD), microdrive, and magneto-optical disks, andmagnetic or optical cards, nanosystems (including molecular memory ICs),or any type of media or device suitable for storing instructions and/ordata. Additionally, the entire program code, or portions thereof, may betransmitted and downloaded from a software source over a transmissionmedium, e.g., over the Internet, or from another server, as is wellknown, or transmitted over any other conventional network connection asis well known (e.g., extranet, VPN, LAN, etc.) using any communicationmedium and protocols (e.g., TCP/IP, HTTP, HTTPS, Ethernet, etc.) as arewell known. It will also be appreciated that computer code forimplementing embodiments can be implemented in any programming languagethat can be executed on a client system and/or server or server systemsuch as, for example, C, C++, HTML, any other markup language, Java™JavaScript, ActiveX, any other scripting language, such as VBScript, andmany other programming languages as are well known may be used. (Java™is a trademark of Sun Microsystems, Inc.).

According to one embodiment, each system 616 is configured to providewebpages, forms, applications, data and media content to user (client)systems 612 to support the access by user systems 612 as tenants ofsystem 616. As such, system 616 provides security mechanisms to keepeach tenant's data separate unless the data is shared. If more than oneMTS is used, they may be located in close proximity to one another(e.g., in a server farm located in a single building or campus), or theymay be distributed at locations remote from one another (e.g., one ormore servers located in city A and one or more servers located in cityB). As used herein, each MTS could include one or more logically and/orphysically connected servers distributed locally or across one or moregeographic locations. Additionally, the term “server” is meant toinclude a computer system, including processing hardware and processspace(s), and an associated storage system and database application(e.g., OODBMS or RDBMS) as is well known in the art. It should also beunderstood that “server system” and “server” are often usedinterchangeably herein. Similarly, the database object described hereincan be implemented as single databases, a distributed database, acollection of distributed databases, a database with redundant online oroffline backups or other redundancies, etc., and might include adistributed database or storage network and associated processingintelligence.

FIG. 7 also illustrates environment 610. However, in FIG. 7 elements ofsystem 616 and various interconnections in an embodiment are furtherillustrated. FIG. 7 shows that user system 612 may include processorsystem 612A, memory system 612B, input system 612C, and output system612D. FIG. 7 shows network 614 and system 616. FIG. 7 also shows thatsystem 616 may include tenant data storage 622, tenant data 623, systemdata storage 624, system data 625, User Interface (UI) 730, ApplicationProgram Interface (API) 732, PL/SOQL 734, save routines 736, applicationsetup mechanism 738, applications servers 700 ₁-700 _(N), system processspace 702, tenant process spaces 704, tenant management process space710, tenant storage area 712, user storage 714, and application metadata716. In other embodiments, environment 610 may not have the sameelements as those listed above and/or may have other elements insteadof, or in addition to, those listed above.

User system 612, network 614, system 616, tenant data storage 622, andsystem data storage 624 were discussed above in FIG. 6. Regarding usersystem 612, processor system 612A may be any combination of one or moreprocessors. Memory system 612B may be any combination of one or morememory devices, short term, and/or long term memory. Input system 612Cmay be any combination of input devices, such as one or more keyboards,mice, trackballs, scanners, cameras, and/or interfaces to networks.Output system 612D may be any combination of output devices, such as oneor more monitors, printers, and/or interfaces to networks. As shown byFIG. 7, system 616 may include a network interface 620 (of FIG. 6)implemented as a set of HTTP application servers 700, an applicationplatform 618, tenant data storage 622, and system data storage 624. Alsoshown is system process space 702, including individual tenant processspaces 704 and a tenant management process space 710. Each applicationserver 700 may be configured to tenant data storage 622 and the tenantdata 623 therein, and system data storage 624 and the system data 625therein to serve requests of user systems 612. The tenant data 623 mightbe divided into individual tenant storage areas 712, which can be eithera physical arrangement and/or a logical arrangement of data. Within eachtenant storage area 712, user storage 714 and application metadata 716might be similarly allocated for each user. For example, a copy of auser's most recently used (MRU) items might be stored to user storage714. Similarly, a copy of MRU items for an entire organization that is atenant might be stored to tenant storage area 712. A UI 730 provides auser interface and an API 732 provides an application programmerinterface to system 616 resident processes to users and/or developers atuser systems 612. The tenant data and the system data may be stored invarious databases, such as one or more Oracle™ databases.

Application platform 618 includes an application setup mechanism 738that supports application developers' creation and management ofapplications, which may be saved as metadata into tenant data storage622 by save routines 736 for execution by subscribers as one or moretenant process spaces 704 managed by tenant management process 710 forexample. Invocations to such applications may be coded using PL/SOQL 734that provides a programming language style interface extension to API732. A detailed description of some PL/SOQL language embodiments isdiscussed in commonly owned U.S. Pat. No. 7,730,478 entitled, “Methodand System for Allowing Access to Developed Applicants via aMulti-Tenant Database On-Demand Database Service”, issued Jun. 1, 2010to Craig Weissman, which is incorporated in its entirety herein for allpurposes. Invocations to applications may be detected by one or moresystem processes, which manage retrieving application metadata 716 forthe subscriber making the invocation and executing the metadata as anapplication in a virtual machine.

Each application server 700 may be communicably coupled to databasesystems, e.g., having access to system data 625 and tenant data 623, viaa different network connection. For example, one application server 700₁ might be coupled via the network 614 (e.g., the Internet), anotherapplication server 700 _(N-1) might be coupled via a direct networklink, and another application server 700 _(N) might be coupled by yet adifferent network connection. Transfer Control Protocol and InternetProtocol (TCP/IP) are typical protocols for communicating betweenapplication servers 700 and the database system. However, it will beapparent to one skilled in the art that other transport protocols may beused to optimize the system depending on the network interconnect used.

In certain embodiments, each application server 700 is configured tohandle requests for any user associated with any organization that is atenant. Because it is desirable to be able to add and remove applicationservers from the server pool at any time for any reason, there ispreferably no server affinity for a user and/or organization to aspecific application server 700. In one embodiment, therefore, aninterface system implementing a load balancing function (e.g., an F5Big-IP load balancer) is communicably coupled between the applicationservers 700 and the user systems 612 to distribute requests to theapplication servers 700. In one embodiment, the load balancer uses aleast connections algorithm to route user requests to the applicationservers 700. Other examples of load balancing algorithms, such as roundrobin and observed response time, also can be used. For example, incertain embodiments, three consecutive requests from the same user couldhit three different application servers 700, and three requests fromdifferent users could hit the same application server 700. In thismanner, system 616 is multi-tenant, wherein system 616 handles storageof, and access to, different objects, data and applications acrossdisparate users and organizations.

As an example of storage, one tenant might be a company that employs asales force where each salesperson uses system 616 to manage their salesprocess. Thus, a user might maintain contact data, leads data, customerfollow-up data, performance data, goals and progress data, etc., allapplicable to that user's personal sales process (e.g., in tenant datastorage 622). In an example of a MTS arrangement, since all of the dataand the applications to access, view, modify, report, transmit,calculate, etc., can be maintained and accessed by a user system havingnothing more than network access, the user can manage his or her salesefforts and cycles from any of many different user systems. For example,if a salesperson is visiting a customer and the customer has Internetaccess in their lobby, the salesperson can obtain critical updates as tothat customer while waiting for the customer to arrive in the lobby.

While each user's data might be separate from other users' dataregardless of the employers of each user, some data might beorganization-wide data shared or accessible by a plurality of users orall of the users for a given organization that is a tenant. Thus, theremight be some data structures managed by system 616 that are allocatedat the tenant level while other data structures might be managed at theuser level. Because an MTS might support multiple tenants includingpossible competitors, the MTS should have security protocols that keepdata, applications, and application use separate. Also, because manytenants may opt for access to an MTS rather than maintain their ownsystem, redundancy, up-time, and backup are additional functions thatmay be implemented in the MTS. In addition to user-specific data andtenant specific data, system 616 might also maintain system level datausable by multiple tenants or other data. Such system level data mightinclude industry reports, news, postings, and the like that are sharableamong tenants.

In certain embodiments, user systems 612 (which may be client systems)communicate with application servers 700 to request and updatesystem-level and tenant-level data from system 616 that may requiresending one or more queries to tenant data storage 622 and/or systemdata storage 624. System 616 (e.g., an application server 700 in system616) automatically generates one or more SQL statements (e.g., one ormore SQL queries) that are designed to access the desired information.System data storage 624 may generate query plans to access the requesteddata from the database.

Each database can generally be viewed as a collection of objects, suchas a set of logical tables, containing data fitted into predefinedcategories. A “table” is one representation of a data object, and may beused herein to simplify the conceptual description of objects and customobjects. It should be understood that “table” and “object” may be usedinterchangeably herein. Each table generally contains one or more datacategories logically arranged as columns or fields in a viewable schema.Each row or record of a table contains an instance of data for eachcategory defined by the fields. For example, a CRM database may includea table that describes a customer with fields for basic contactinformation such as name, address, phone number, fax number, etc.Another table might describe a purchase order, including fields forinformation such as customer, product, sale price, date, etc. In somemulti-tenant database systems, standard entity tables might be providedfor use by all tenants. For CRM database applications, such standardentities might include tables for Account, Contact, Lead, andOpportunity data, each containing pre-defined fields. It should beunderstood that the word “entity” may also be used interchangeablyherein with “object” and “table”.

In some multi-tenant database systems, tenants may be allowed to createand store custom objects, or they may be allowed to customize standardentities or objects, for example by creating custom fields for standardobjects, including custom index fields. U.S. patent application Ser. No.10/817,161, filed Apr. 2, 2004, entitled “Custom Entities and Fields ina Multi-Tenant Database System”, and which is hereby incorporated hereinby reference, teaches systems and methods for creating custom objects aswell as customizing standard objects in a multi-tenant database system.In certain embodiments, for example, all custom entity data rows arestored in a single multi-tenant physical table, which may containmultiple logical tables per organization. It is transparent to customersthat their multiple “tables” are in fact stored in one large table orthat their data may be stored in the same table as the data of othercustomers.

Any of the above embodiments may be used alone or together with oneanother in any combination. Embodiments encompassed within thisspecification may also include embodiments that are only partiallymentioned or alluded to or are not mentioned or alluded to at all inthis brief summary or in the abstract. Although various embodiments mayhave been motivated by various deficiencies with the prior art, whichmay be discussed or alluded to in one or more places in thespecification, the embodiments do not necessarily address any of thesedeficiencies. In other words, different embodiments may addressdifferent deficiencies that may be discussed in the specification. Someembodiments may only partially address some deficiencies or just onedeficiency that may be discussed in the specification, and someembodiments may not address any of these deficiencies.

While one or more implementations have been described by way of exampleand in terms of the specific embodiments, it is to be understood thatone or more implementations are not limited to the disclosedembodiments. To the contrary, it is intended to cover variousmodifications and similar arrangements as would be apparent to thoseskilled in the art. Therefore, the scope of the appended claims shouldbe accorded the broadest interpretation so as to encompass all suchmodifications and similar arrangements. It is to be understood that theabove description is intended to be illustrative, and not restrictive.

What is claimed is:
 1. An electronic device configured to implementdynamic deployment of access controls anchored on request actions in amulti-user, on-demand computing environment, comprising: at least onephysical memory device capable to store one or more multi-user on demanddatabases; and one or more processors coupled with the at least onephysical memory device, the one or more processors configurable to:receive, via a user interface, a request to access one or more resourcesmanaged by the electronic device in the multi-user, on demand computingenvironment, the request comprising one or more request elements;determine that the request matches one or more anchorless rules thatlack dependency on resources engaged during a lifetime of the request;apply the one or more anchorless rules matched by the request; andresponsive to the one or more anchorless rules lacking a blocking rulefor the request, apply one or more virtual access check rules to therequest, wherein the one or more virtual access check rules are anchoredto specific request actions of the one or more request elements of therequest.
 2. The electronic device of claim 1 wherein the one or moreprocessors are configurable to block the request responsive to the oneor more of the anchorless rules comprising the blocking rule for therequest.
 3. The electronic device of claim 1 wherein the one or moreprocessors are configurable to apply one or more anchored rules to therequest.
 4. The electronic device of claim 3, wherein the anchored ruleis anchored to at least one of a user permission or an entity operationassociated with the request.
 5. The electronic device of claim 4,wherein the one or more processors are configurable to block the requestwhen the one or more of the anchored rules comprises a blocking rule forthe request.
 6. The electronic device of claim 1, wherein the one ormore anchorless rules are dependent on resources available directly inthe request.
 7. The electronic device of claim 1, wherein the one ormore anchorless rules are to block POST requests to a uniform resourceidentifier (URI) pattern in the request.
 8. A non-transitorycomputer-readable medium having stored thereon instructions that, whenexecuted by one or more processors, are configurable to cause the one ormore processors to: receive, via a user interface, a request to accessone or more resources managed by the one or more processors of anelectronic device in a multi-user, on demand computing environment, therequest comprising one or more request elements; determine that therequest matches one or more anchorless rules that lack dependency onresources engaged during a lifetime of the request; apply the one ormore anchorless rules matched by the request; and responsive to the oneor more anchorless rules lacking a blocking rule for the request, applyone or more virtual access check rules to the request, wherein the oneor more virtual access check rules are anchored to specific requestactions of the one or more request elements of the request.
 9. Thenon-transitory computer-readable medium of claim 8, further comprisinginstructions that, when executed by the one or more processors, areconfigurable to cause the one or more processors to block the requestresponsive to the one or more of the anchorless rules comprising theblocking rule for the request.
 10. The non-transitory computer-readablemedium of claim 8, further comprising instructions that, when executedby the one or more processors, are configurable to cause the one or moreprocessors to apply one or more anchored rules to the request.
 11. Thenon-transitory computer-readable medium of claim 10, wherein theanchored rule is anchored to at least one of a user permission or anentity operation associated with the request.
 12. The non-transitorycomputer-readable medium of claim 11, further comprising instructionsthat, when executed by the one or more processors, are configurable tocause the one or more processors to: block the request when the one ormore of the anchored rules comprises a blocking rule for the request.13. The non-transitory computer-readable medium of claim 8, wherein theone or more anchorless rules are dependent on resources availabledirectly in the request.
 14. The non-transitory computer-readable mediumof claim 8, wherein the one or more anchorless rules are to block POSTrequests to a uniform resource identifier (URI) pattern in the request.15. A method to implement secure data transfer between entities in amulti-user, on-demand computing environment: receiving, via a userinterface, a request to access one or more resources managed by anelectronic device in the multi-user, on demand computing environment,the request comprising one or more request elements; determining thatthe request matches one or more anchorless rules that lack dependency onresources engaged during a lifetime of the request; applying the one ormore anchorless rules matched by the request; and responsive to the oneor more anchorless rules lacking a blocking rule for the request,applying one or more virtual access check rules to the request, whereinthe one or more virtual access check rules are anchored to specificrequest actions of the one or more request elements of the request. 16.The method of claim 15, further comprising blocking the requestresponsive to the one or more of the anchorless rules comprising theblocking rule for the request.
 17. The method of claim 15, furthercomprising applying one or more anchored rules to the request.
 18. Themethod of claim 17, wherein the anchored rule is anchored to at leastone of a user permission or an entity operation associated with therequest.
 19. The method of claim 18, further comprising blocking therequest when the one or more of the anchored rules comprises a blockingrule for the request.
 20. The method of claim 15, wherein the one ormore anchorless rules are dependent on resources available directly inthe request.